An address parsing flaw in Nodemailer causes quoted local‑part addresses followed by RFC 5322 comments to be normalized into a value that includes attacker‑controlled domain text separated by a literal space. The resulting address is stored in the SMTP envelope without further validation, so an application that accepts user input could send a message to an unintended recipient or a domain that the application otherwise forbids. This may enable malicious payloads to be delivered or cause mail loss due to deceptive address resolution.

The flaw resides in Nodemailer versions from 9.1.0 through 10.0.8 inclusive. Users running any of those releases on Node.js should check the installed package and verify the version. The problem is triggered only when the local part of the address is quoted and immediately followed by a comment containing domain atoms. Authentication or envelope construction code that relies on Nodemailer without additional input checks is vulnerable.

With a CVSS score of 6.9 the vulnerability presents moderate risk. The EPSS score is currently unavailable, and the issue is not listed in the CISA KEV catalog. Exploitation requires an attacker who can supply a crafted recipient address to an application that passes it unvalidated to Nodemailer. If such an input is accepted, the library builds an SMTP envelope containing the malformed address, which may allow the sending of messages to unintended recipients or misuse of the mail system. Based on the description, the likely attack vector is via user‑controlled input such as form fields or API payloads that supply email recipients. No confirmation exists that mail would be routed to the attacker’s domain on live SMTP servers, but the lack of strict validation creates a potential for abuse.